diff --git a/pkgs/by-name/bi/bicep/package.nix b/pkgs/by-name/bi/bicep/package.nix
index 2f72cd05cdcf..6a35c139b3c4 100644
--- a/pkgs/by-name/bi/bicep/package.nix
+++ b/pkgs/by-name/bi/bicep/package.nix
@@ -5,6 +5,7 @@
   fetchFromGitHub,
   dotnetCorePackages,
   mono,
+  jq,
 }:
 
 buildDotnetModule rec {
@@ -20,6 +21,9 @@ buildDotnetModule rec {
 
   postPatch = ''
     substituteInPlace src/Directory.Build.props --replace-fail "<TreatWarningsAsErrors>true</TreatWarningsAsErrors>" ""
+    # Upstream uses rollForward = disable, which pins to an *exact* .NET SDK version.
+    jq '.sdk.rollForward = "latestMinor"' < global.json > global.json.tmp
+    mv global.json.tmp global.json
   '';
 
   projectFile = [
@@ -33,6 +37,8 @@ buildDotnetModule rec {
 
   dotnet-runtime = dotnetCorePackages.runtime_8_0;
 
+  nativeBuildInputs = [ jq ];
+
   doCheck = !(stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64); # mono is not available on aarch64-darwin
 
   nativeCheckInputs = [ mono ];